get_user_token

What get_user_token does on Proxmox MCP Server

AI agents call get_user_token to retrieve information from Proxmox MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_user_token is rated Low

This tool retrieves metadata about an API token—likely including token ID, name, expiration, permissions, or similar attributes—without modifying, executing, or deleting anything. However, API tokens are sensitive security credentials, so unauthorized access to their details could facilitate privilege escalation or unauthorized access to the Proxmox infrastructure; hence medium severity rather than low.

From the tool's definition Tool name 'get_user_token' and description 'Get details for a specific API token' indicate data retrieval with no side effects. The verb 'Get' and 'details' clearly signal a read-only query operation.

The rule that runs get_user_token safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Proxmox MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_user_token, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_user_token": {}
  }
}

Questions about get_user_token